Centralised BMS oversight
without exposing the network

Building Management Systems control the functions that keep a council estate running — heating, ventilation, energy usage, environmental conditions. For good reason, public-sector cybersecurity policy keeps them off the public internet entirely: exposing a BMS creates a real risk of hacking attempts, system shutdowns, or damage to critical infrastructure.

But that isolation has a cost. Faults can only be found by someone on site. There’s no way to see multiple buildings from one place, no way to spot a developing problem before it becomes a callout, and no way to rebalance usage or resource across an estate without physically walking it first.

The brief was to find a secure, reliable way to get operational data out of an isolated, on-premises BMS network and into a cloud-based platform — without opening any door back into the system that controls the building.

dbr designed and installed an air-gapped monitoring layer that physically and logically separates the Town Hall’s BMS network from anything connected to the public internet.

A Data Collector reads operational data directly from the BMS. That data passes to a Data Sender over a strictly one-way channel — the air gap is enforced in hardware, not software, so there is no route back into the BMS from the Data Sender or anything beyond it, regardless of what happens downstream.

From there, data reaches dbr’s cloud servers and is made available to authorised council staff on a live dashboard, from any web-enabled device. The BMS itself never accepts a connection from outside — it only ever sends.

The same architecture is already running across other critical infrastructure environments, and is recognised as a proven approach for public-sector bodies that need to modernise estate management while staying inside national cybersecurity guidance.

A BMS doesn’t just report numbers — it controls heating, ventilation and energy usage across a building residents and staff use every day. A conventional cloud-connected integration, with remote access or a VPN back into the Town Hall network, would have given an attacker who compromised the dashboard or stole a credential a route to that control. For a public-sector estate, that’s not just a service-disruption risk — it’s a potential pivot point into the council’s wider network, which is exactly what the original air-gap policy existed to prevent.

dbr’s architecture doesn’t reopen that door under a different name. There is no credential, VPN, or remote-access tool sitting on the BMS side, because none were built — the air gap is physical, not a permission that could be misconfigured or a policy that could be overridden under pressure. Even a total compromise of dbr’s cloud infrastructure would leave an attacker with nowhere to go: the BMS keeps running the Town Hall exactly as it always has, isolated precisely as the council’s original policy required, while the visibility the council was missing now exists alongside it.

Real-time visibility of key building systems, without exposing the BMS to any external network

Faster fault diagnosis, replacing reliance on someone being physically on site

Centralised oversight, live, across facilities from a single dashboard

Better-supported energy efficiency and sustainability reporting

Full separation maintained between the BMS and the public internet throughout — the risk of cyber intrusion or unauthorised system access is designed out, not just managed